Failure detection and communication system for electrically driven vehicles

ABSTRACT

To effect failure detection and communication between the modules in a modular control system for an electrically driven vehicle in which modules are interconnected by a serial data bus, one line of the serial bus may be biased high or low by modules of the system when a fault is detected. This is detected by a kill system of the modules to which disable safety related functions of each module are applicable. Modules other than the remote control module can include wake up circuitry which supplies power to the modules at start up, or deactivated modules, when the data line is biased high. The modules preferably operate as finite state machines with each module storing in its memory network variables required for the operation of that module. The network variables include the state of other modules, external demand signals, and measured variables of the system.

TECHNICAL FIELD

This invention relates to controllers for electrically driven vehicles,particularly wheelchairs, scooters and the like. Particularly, althoughnot exclusively, the invention relates to a modular control system inwhich the modules are connected by a digital serial bus.

BACKGROUND TO THE INVENTION

To the present time wheelchair controllers have typically consisted of asingle unit containing all control circuitry which receives controlcommands from a joy stick. Should the controller fail then the wholeunit must be replaced. Further, the addition of additional modules orfeatures typically required physical modification of the controller.

European patent EP 0345785 discloses a wheelchair controller comprisinga command module and a control unit linked by a serial connection. Boththe command module and control module include processing units. A keyPROM contains a code to enable an operator to use the chair as well asuser defined parameters setting the operational characteristics of thechair. This specification does not however contemplate an expandiblemodular system. The serial connection is merely a means of linking thecommand module to the control module and does not suggest the use of aserial bus interconnecting a number of modules. The programmablefeatures provided are merely to allow user requirements to be set, notto enable configuration for different hardware configurations.

Safety features are of concern to wheelchair manufacturers as faultyoperation of a controller can result in personal injury. Prior artwheelchair controllers have offered limited safeguards. Typically allthat is provided is a switch allowing the power supply or the motors tobe disconnected from the controller. This may result in undesirablyrapid stopping of the wheelchair or in a wheelchair malfunctioning froma fault which could have been detected. A particular concern withwheelchair controllers is that should a malfunction occur the drivingand actuating modules should assume a safe state.

A problem has also existed in that the less expensive microcomputerchips only include eight bit pulse width modulators. When the output ofan eight bit pulse width modulator is used to control a DC motor of awheelchair, the resolution is noticeably coarser than for analoguecontrol. To date it has not been possible to obtain similar performanceto analogue controllers using microcomputers having eight bit pulsewidth modulators.

Further, the mounting of components, such as semi-conductors, in casingshas been labour intensive, as has been the need to connect wires from acircuit board to a component secured to the casing. Servicing andreplacement is also difficult.

DISCLOSURE OF THE INVENTION

It is an object of the present invention to provide a control means forelectrically driven vehicles which overcomes at least some of the aboveproblems or at least provides the public with a useful choice.

According to a first aspect of the invention there is provided a controlmeans for an electrically driven vehicle comprising two or more modulesinterconnected by a serial bus, said serial bus including one or moredata lines, wherein one or more module includes means to shift a DC biasvoltage on a data line of said serial bus and one or more moduleincludes means which monitors the DC voltage on said data line of serialbus and disables functions of the module when the detected DC biasvoltage is outside a set voltage range. Preferably the serial bus hastwo data lines, only one of which is biased by the DC bias voltage.Preferably all safety related modules are disabled when the DC biasvoltage is outside the set voltage range and all modules can vary the DCbias voltage on the serial bus.

The invention further provides a module for use in a modular controlmeans for an electrically driven vehicle, the modules of said modularcontrol means being interconnected by a serial bus, wherein the moduleincludes kill means to disable functions of the module upon detectingthat the DC bias level on a data line of the serial bus is outside a setrange. The invention also provides a method of disabling modules of acontrol,means for an electrically driven vehicle, said modules beinginterconnected by a serial bus having one or more data lines, saidmethod comprising applying a DC bias voltage within a set voltage rangeto one of the data lines to enable the modules and shifting the DC biasvoltage outside the set voltage range to disable functions of themodules.

According to a further aspect of the invention there is provided amodule for use in a modular control means for an electrically drivenvehicle, the modules of said modular control means being interconnectedby a serial bus, wherein the module includes means to disable functionsof the module upon detecting that the DC bias level on a data line ofthe serial bus is outside a set range.

According to a further aspect of the invention there is provided amethod of controlling a pulse width modulator to drive a DC motor, thepulse width modulator having N input bits and the method comprising:

inputting a required motor speed value consisting of N+M bits to aprocessor at the beginning of a sampling period;

for a number of pulse width modulator cycles adding 1 bit or nothing tothe N bits, dependent upon the value of the M Bits, to produce aplurality of output values of N bits which over a sampling periodrepresent an average output substantially equal to N+M;

and outputting the output values from the processor to the pulse widthmodulator. Preferably the sampling period is 2^(M) pulse width modulatorcycles.

According to a further aspect of the invention there is provided amodule for use in a modular control means for an electrically drivenvehicle, the modules of said modular control means being interconnectedby a serial data bus, wherein the module includes wake-up means whichmonitors the DC bias level of a data line of the serial data bus whenthe module is deactivated and supplies power to the module upondetecting that the DC bias level is outside of a set range.

According to a still further aspect of the invention there is provided acontrol means for an electrically driven vehicle comprising a pluralityof modules interconnected by a serial bus, each module storing networkvariables required for the operation of that module in memory; externalnetwork variables required by that module being updated via the serialbus at a required rate from the module from which the network variableoriginates.

Preferably the modules act as finite state machines with transitionsbetween states being dependent upon the state of system networkvariables.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will be described by way of example with reference to theaccompanying drawings in which:

FIG. 1: Shows a possible modular wheelchair controller configuration.

FIG. 2: Shows in block diagram form the circuit of a motor controllermodule shown in FIG. 1.

FIG. 3: Shows a functional diagram of a MOSFET H-bridge and drivinglogic of the circuit of FIG. 2.

FIG. 4: Shows the current sensor used in the circuit of FIG. 3.

FIG. 5: Shows in block diagram form a remote control module suitable foruse with the motor controller module of FIG. 2.

FIG. 6: Shows a possible "kill function" detection circuit.

FIG. 7: Shows a possible external watchdog detection circuit.

FIG. 8: Shows diagrammatically a method of updating network variablesbetween modules.

FIG. 9: Shows a possible state diagram for a motor controller module.

FIG. 10 and 11: Show the conditions required for transitions between thestates of the state diagram of FIG. 9 and the system actions.

FIG. 12: Shows an arrangement for mounting the printed circuit board ofa module within a casing.

FIG. 13: Shows an end view of the casing when assembled.

FIGS. 14 and 15: Show a preferred semiconductor mounting arrangement.

FIG. 16: Shows in perspective the biasing clip shown in FIGS. 14 and 15.

The wheelchair controller of the present invention is preferably ofmodular design with distributed intelligence (i.e. each module includesa processor). FIG. 1 shows a possible arrangement of modules and theirinterconnection. FIG. 1 shows an arrangement for a wheelchair controllerwhere steering is effected by the differential speed between two drivingmotors. For other applications, such as scooters, only one motor need becontrolled.

Instead of a single controller for both motors (as shown in FIG. 1) twoseparate controllers may be provided for each motor. The separation ofmotor controller modules has the advantage that the motor controllersmay be mounted in close proximity with the motor. This enables an entiremotor controller and motor to be replaced should a fault arise.Furthermore, this arrangement facilitates temperature sensing of themotor. Combining two motor controllers in a single unit does howeversimplify manufacture and reduce cost.

In the arrangement shown in FIG. 1 motor controller 2 is directlyconnected to batteries 3. As the motor controller has high power demandsit is desirable that it be connected directly to the battery supply.Left and right motors 4 and 5 and parking brake. solenoids 6 and 7 arealso directly connected to the motor controller 2.

Each module in FIG. 1 includes input/output ports 8 5 and 9 to allowinterconnection of modules via serial bus 10. The serial bus preferablyincludes two power supply lines to provide power from the motorcontroller to peripheral devices or to allow charging of battery 3 froma battery charger unit 11. Such lines will be current limited (to say 15amps). The serial bus preferably comprises a two line differentialserial data bus comprising the signal lines CAN₁₃ H and CAN₋₋ L.Although the system can operate on one line, two lines are preferred fornoise immunity and reliability (i.e.: communication is still possible ifone line fails).

The system will preferably operate under the highly secure CAN protocolused in ABS braking systems. This protocol is preferred due to its noiseimmunity, and four level error checking. A high degree of reliability isrequired for wheelchair controllers where faulty operation may causepersonal injury.

The daisy chain interconnection of modules means that a relatively slowdata rate (100 Kbit/sec) must be used to avoid signal reflection. Thisis not a problem as the rate of data exchange required for a wheelchaircontroller is not great. The arrangement however provides greatflexibility in allowing additional modules to be added as requiredmerely by plugging in the new module and reprogramming the system. Afurther module can then be connected to the available port of the newmodule, and so on.

A basic system will comprise a motor controller 2 and a basic remotecontrol 12. Further peripheral devices may be added such as trackfollowing 13, collision avoidance 14, lighting control 15, seat recliner16 and seat raise 17 modules. Further specialised modules may be addedsuch as breath, head and voice input control devices; visual displaysincluding lamps, LED's and matrix displays; synthesised speech modules;robot manipulator arms; navigational aids such as collision avoidanceaids and track following guidance systems; battery charger modules;environmental control units and computer and telephone interfaces.

The basic remote module 12 may include only a joystick for a user tocontrol the direction of motion. When further peripheral modules areadded a full remote control 18 may be substituted for the basic remote12. The full remote may include a number of switches to actuate theperipheral modules. The full remote may have a first row of switcheswhich allow an operator to select a module to be controlled (e.g. seatraise). Upon selection of the module to be controlled a second row ofswitches (incorporating displays therein or adjacent thereto) maypresent the control options associated with that module. For exampleLCD's may be provided in the top of these switches displaying functionsassociated with that module (eg raise front of seat, raise back of seat,raise left side of seat, raise right side of seat etc). In this way iffor example eight switches are provided to select modules and eightswitches are provided to control the functions of each module, then 64functions can be provided from 16 switches. Further this system givesflexibility to add new functions merely by reprogramming.

A major advantage of the modular configuration described is that asystem can be expanded without, requiring physical modification orreplacement of large parts of the system. As new modules are added thesystem can be reprogroomed via programmer 1 so that the remote control,for example, will know of the existence of the new module and will allowcommunication with the new module. Preferably the remote control module12 and the motor controller module 2 store the entire systemconfiguration so that a replacement module for a faulty module may beautomatically configured upon connection to the system. Programmer 1 canbe connected to any available port on the system and may be used forreprogramming or diagnostics. Programmer 1 may be used to programme usercontrol parameters such as preferred seat position and response speeds.

Referring now to FIG. 2, a block diagram of the motor controller 2 ofFIG. 1 is shown. The circuit is a DC motor controller implementingdigital servo control. 24 volt battery 3 is connected directly tovoltage regulator 20 and relay 21. Voltage regulator 20 supplies 5 and12 volt power supplies to the circuitry of the controller. Relay 21switches the direct battery supply to the left H-bridge 22 and rightH-bridge 23. A pre-charge circuit 24 is provided to raise the voltageacross large capacitors on the H-bridge side of the relay to within afew volts of the battery voltage. This is to ensure that the relaycontacts are not damaged by a rapid inrush of current followingconnection of the H-bridges, with associated large capacitances, to thebattery supply.

Looking at the bottom of FIG. 2 the DX bus connectors 8 and 9 of FIG. 1are shown. The bus is seen to consist of data lines CAN₋₋ L (25) andCAN₋₋ H (26) and power supply lines: battery negative 27 and batterypositive 28. The battery positive line 28 is limited to a maximumcurrent of 15 amps by circuit breaker 29. The power supply lines 27 and28 supply power to all of the modules connected on the serial bus.Likewise, all modules communicate over the CAN₋₋ L and CAN₋₋ H datalines.

Signals from the lines CAN₋₋ H and CAN₋₋ L pass to CAN transceiver 30.Communications are transferred from CAN transceiver 30 to microcomputer31 via line 32 and from microcomputer 31 to CAN transceiver 30 via thetwo transmit data lines 33.

Microcomputer 31 is preferably a Philips 80C592 or a Philips 87C592microcomputer. This microcomputer includes a central processing unit,RAM, ROM, an analogue to digital converter, a pulse width modulatorgenerator, CAN logic circuitry, UART and input/output interfaces. Acrystal oscillator 34 is connected to microcomputer 31 to set thefrequency of the internal clock. Electrically erasable, programmableread only memory (EEPROM) 35 is connected to microcomputer 31 to enablethe storage of fixed configuration and/or user parameters. A statusdisplay 36 is driven by microcomputer 31 to display status messages. Anasynchronous serial interface 37 connects microcomputer 31 to an RS232port 38. Analogue monitoring of the motor and circuit temperatures,battery voltage and relay contacts is performed by analogue monitoringcircuitry 39. These analogue values are supplied to the analogue todigital convertor of microcomputer 31.

Pulse width modulator outputs from microcomputer 31 are supplied to thedriving logic of the H-bridges 22, 23 via lines 40 and 41. A currentlimit value is supplied to the driving logic 22, 23 via line 42. Acommon disable line 43 connected to the H-bridge logic circuits allowsthe H-bridges to be disabled. The H-bridges may be disabled in responseto an over-voltage being detected on either H-bridge by over-voltagedetection circuitry 44. Alternatively, the H-bridge may be disabled inresponse to the detection of a kill signal on the serial bus by killsignal detector 45. Motor speed detectors 50 and 51 measure the motorvoltages across points 56a and 58a of FIG. 3 and supply the voltages tothe microcomputer via RC filters. Motor current detectors 47 and 48provide signals representative of the motor currents to microcomputer 31(see FIGS. 3 and 4).

Isolation relay 21 is driven by relay drive 46 in response to commandsreceived from microcomputer 31. Relay drive 46 is also responsive tosignals from kill signal detector 45 or over-voltage detector 44 orwatchdog circuit 66 to isolate the H-bridges from the relay. Park brakedrivers 47 are responsive to commands from microcomputer 31 to apply andrelease the park brakes. Park brake drivers 47 are alto responsive tothe watchdog circuit and kill signal detector to apply the park brakes.Wake up circuit 52 is responsive to the bias level on CAN₋₋ H to supplyan enabling signal to voltage regulator 20 if it is off. Preferably ahigh bias of CAN₋₋ H causes wake up circuit 52 to enable voltageregulator 20.

Referring now to FIG. 3 a functional diagram of an H-bridge and drivinglogic 22 or 23 is shown. This diagram does not show all of the necessarycomponents for a working bridge and is merely for the purpose ofexplaining the general operation of the H-bridges.

Pulse width modulator driving signals 40, 41 from microcomputer 31 aresupplied to driving logic 53 and 54. Driving logic 53 and 54 ispreferably based on linear technology LT1158 chips. Bridge logic 53drives power MOSFETS 55 and 56 and bridge logic 54 drives power MOSFETS57 and 58. MOSFETS 55 to 58 may consist of two MOSFETS driven inparallel to cope with the required current in an economical manner andprovide redundancy should one MOSFET fail. DC motor 59 is connectedacross the points of interconnection 56a and 58a of MOSFETS 55 and 56and MOSFETS 57 and 58. Motor current is sensed by a hall effect sensor60 (shown in FIG. 4). This sensor consists of a loop of highpermeability magnetic material 62 passing about conductor 61 with a halleffect sensor 63 within the gap in loop 62. The output of the halleffect sensor is supplied to the microcomputer.

Referring now to FIG. 5 a remote control unit (12 or 18 in FIG. 1) isshown. Again the circuit is based on a Philips 80C592 or 87C592microcomputer 70. Upon actuation of a power switch 96 the 24 volt DCsupply is supplied to voltage regulator 71 via power circuitry 72.Voltage regulator 71 provides 5 and 12 volt supplies to the internalcircuitry. Power supply supervision circuit 73 monitors the 5 voltsupply to EEPROM 74 and disables power circuitry 72 if there is afailure in the 5 volt supply or in response to a control command frommicrocomputer 70 via line 75. Microcomputer 70 may also inhibit thepower supply via line 76, connected to an inhibit input of powercircuitry 72. Charger detection circuit 77 inhibits power circuit 72 viainhibit line 76 when charging is detected. This is to ensure that thecircuitry is not exposed to transient variations which may occur duringcharging and to provide a signal to microcomputer 70 to disable drivingof the wheelchair. Crystal oscillator 79 sets the frequency of operationof the microcomputer 70. Status display 80 enables status informationfrom the microcomputer to be displayed. Analogue user inputs 81 aresupplied to the analogue to digital converter of microcomputer 70 viaanalogue signal conditioning 83. This allows a wide variety of analoguecontrol inputs to be input to the microcomputer 70. Inputs from thejoystick 97 are supplied to joystick buffer 82, which are input to theanalogue to digital converter of microcomputer 70 via analogue signalconditioning circuitry 83. Parallel port expansion is provided byparallel input/output bus 84. Serial port expansion is possible viaserial interface 86. These expansion ports allow circuitry specific to aparticular module to be interfaced with microcomputer 70. It is to beappreciated that other modules may be based on the circuit of FIG. 2with appropriate modifications for the particular module function; e.g.:actuator/motor driver circuitry for a seat reclining module. Switchinputs may be supplied to microcomputer 70 via input/output interface85. An asynchronous serial interface 87 connects microcomputer 70 toRS232 port 88. This enables communication with a computer or otherdevice fitted with an RS232 interface.

Lines 89 and 90 connect CAN transceiver 91 to data lines CAN₋₋ L andCAN₋₋ H of the serial bus. Data received by CAN transceiver 91 issupplied to microcomputer 70 via receive line 92 and data to betransmitted from microcomputer 70 is supplied to CAN transceiver 91 viatwo lines 93. A kill switch 94, is supplied on the remote control moduleto enable a user to disable all modules of the system. Upon detectingactuation of the kill switch 94, kill input interface 95 sends a signalto CAN transceiver 91 which causes it to bias the data line CAN₋₋ H (as,will be described in more detail hereinafter). The operation of killinput interface is independent of the operation of microcomputer 70.

The operation of a simple system consisting of the remote module of FIG.5 and motor controller of FIG. 2 will now be described with reference toFIGS. 2 to 5. Referring firstly to FIG. 5, a user actuates the remotemodule by depressing power switch 96. This enables power circuitry 72which supplies power to voltage regulator 71. Power is thus supplied tothe remote module. Actuation of switch 96 or movement of the joystickmay be detected by microcomputer 70 and cause it to instruct the CANtransceiver 91 to bias CAN--.sub. H high for a predetermined period.This will be detected by wake up circuit 52 of the motor controller(FIG. 2) which will activate voltage regulator 20 and supply power tothe circuity of the motor controller. In a larger system the othermodules would also be activated in this way. The modules may be turnedoff by commands transmitted over the serial bus.

To move the wheel chair a user then moves the arm of joystick 97 in thedesired direction of motion. Signals representative of the position ofthe joystick are supplied to the analogue to digital converter ofmicrocomputer 70 via buffer 82 and signal conditioning circuity 83.Microcomputer 70 then computes required direction and speed networkvariables, dependent upon the system configuration for the user (storedin EEEPROM). Microcomputer 70 then transmits the required direction, andspeed network variables and module status information to microcomputer31 via CAN transceivers 91 and 30 over the interconnecting serial linesof the serial network. Upon receiving the desired speed and directioninformation microcomputer 31 calculates the required pulse widthmodulator outputs to achieve the required speed and direction.

The back EMF of a DC motor is equal to the voltage across the motorminus the motor resistance times the current flowing through the motor.Thus; ##EQU1## Where K_(e) is a constant, ##EQU2## is the motor speedand V_(m), I_(m) and R_(m) are the motor voltage, current and resistancerespectively.

Accordingly the back EMF can be calculated by subtracting the voltage atpoint 58a from the voltage at point 56a, then subtracting the currentflowing through the motor (measured by sensor 60) times the motorresistance. This motor back EMF feedback value may be compared with therequired motor speed and direction network variables to determine therequired output of the pulse width modulator for each bridge. Theoutputs of the pulse width modulator are supplied to H-bridge logic 53,54 which supply the signals which drive the MOSFET H-bridges. MOSFETs 55to 58 are in a full H-bridge configuration to allow bidirectional motordrive. N channel devices are used for cost and performance advantages.

The MOSFETs of the bridge are switched in two phases. In phase 1 MOSFETs55 and 58 are switched on whilst MOSFETs 56 and 57 are off. In phase 2MOSFETs 56 and 57 are on whilst MOSFETs 55 and 58 are off. The drivinglogic switches between phases when the detected voltage has decayed to acertain level. This results in a dead time which prevents simultaneousconduction through the FETs on one side. Over-current in the MOSFETs isdetected by monitoring the voltages at 56a and 58a. In the "on" stateMOSFETs can be modelled as a low value resistor. If excessive current isdetected the drive pulse to that MOSFET is terminated for that cycle.

If phases 1 and 2 are of equal duration then the nett voltage output iszero. If phase one is greater than phase 2 the nett output is positiveand the motor rotates in the forward direction. If phase 2 is longerthan phase 1 the net output is negative and the motor rotates inreverse.

A battery voltage input and isolated battery input are supplied to theanalog to digital converter of the micro computer via analoguemonitoring circuit 39. If low battery voltage is detected, say below 22volts, then the available current is decreased to prevent surging and topreserve power. If the battery voltage drops below 18 volts the motorsmay be disabled to ensure there is sufficient power to operate isolationrelay 21 and the park brakes. If the battery voltage rises above a setlevel, say 32 volts, the microcomputer will ramp back driving signalsand prevent further driving until the voltage returns to a normal range.The voltage on the H-bridge side of the isolation relay 21 is alsomonitored. By comparing this value with the battery voltage, faultycontacts in relay 21 can be detected as well as checking for faults inthe microcomputer between the stored status and actual status of therelay. If it is detected that there is a disagreement between the relaystate stored in memory and the actual state then the power module entersa fault mode and prohibits further driving. Temperature sensors monitorthe temperature of the controller (and possibly the motors too) andprovide signals to the analogue to digital converter of the microcomputer indicative of the temperatures. If high controller temperatureis detected then the available current to the motor is decreased toprevent overheating.

Non-volatile memory 35 stores programmable parameters, configurationdata and settings which may be altered by a programming module whenconnected to the system.

An important feature of the invention is a method used to enable ordisable safety related modules (i.e. motor driver and actuator modules)connected to the serial data bus (herein referred to as the "killfunction"). Accordingly to this method a DC bias voltage level issuperimposed on one or both of the serial data lines 25, 26. It ispreferred that only one line (CAN₋₋ H) is biased so that communicationmay continue on the other line when the "kill function" is activated. Ifthe DC bias voltage level is within a given range, safety relatedmodules will be enabled. When the DC bias voltage is in this rangeserial communications from one module to another may actuate the motorcontrollers or peripheral devices to perform the desired functions. If afault occurs in a module the DC bias voltage may be shifted outside ofthe given range. The DC bias level may be shifted either high or low.Preferably when the "kill function" is invoked by the microcomputer of amodule the DC bias level on CAN₋₋ H will be raised above the highestvalue of the given range; typically above 8.4 volts (a "high" bias).When the "kill function" is invoked by a "dead mans switch" the DC biaslevel on CAN₋₋ H will preferably short CAN₋₋ H to ground (i.e. a "low"bias voltage of below 0.6 v).

Each safety related module includes circuitry to detect the bias levelof the CAN₋₋ H line. If a module detects a high or low DC bias on CAN₋₋H certain functionality of the module will be physically disabled (i.e:actuators and motors), independent of the operation of internalsoftware.

Referring now to FIG. 6 a possible "kill function" circuit for eachmodule is shown. An input from the data line CAN₋₋ H is supplied to theinverting input of comparator 100 and the non-inverting input ofcomparator 101 via a resistor 102, capacitor 103 and diode 104conditioning arrangement. Resistor network 105, 106 and 107 forms of avoltage divider which provides an 8.4 volt input to the non-invertingterminal of comparator 100 and a 0.6 volt input to the inverting inputof comparator 101. When the bias voltage on CAN₋₋ H is within the 0.6 to8.4 volt range the output 108 of comparators 100 and 101 is high. Whenthe DC bias voltage on CAN₋₋ H exceeds 8.4 volts or drops below 0.6volts then the output 108 is pulled low. This results in the H-bridgedisable line 43, the park brake disable line 67 and the relay isolationline 68 being pulled low. This results in the H-bridge being disabled,isolation relay 21 being opened and the park brake being applied.

There will preferably be a time delay (for example 1 second) before the"kill function" is invoked. This gives the motor controllermicrocomputer a chance to smoothly ramp down motor voltages to bring thechair to a smooth stop. However, after the predetermined period, say 1second, the "kill function" will be invoked regardless of the operationof the microcomputer 31. If a high or low DC bias on CAN₋₋ H (i.e. above8.4 volts or below 0.6 volts) is detected for a specified time themicrocomputer 31 will configure the CAN communication hardware so thatit can continue to communicate with other modules. Such communicationwill be conducted over CAN₋₋ L only as CAN₋₋ H will still be biasedoutside normal operating range. Although motors and actuators will bedisabled some functionality may remain when the kill function isinvoked. For example, a user may still be able to use a phone interfaceto call for help.

This method of inhibiting modules has the advantage that all safetyrelated modules may be quickly inhibited regardless of whether or notdata communications are occurring on the serial bus. Further, modulesmay be inhibited physically irrespective of the operation of controllingsoftware. By using a DC bias voltage to control the inhibit function onthe serial data bus the need for an additional dedicated inhibit wire isovercome.

As well as the "kill function" the motor controller module has anexternal watchdog function. Every millisecond the microprocessor 31toggles the WDOG port pin 69, creating a 500 hertz square wave. This iscapacitively coupled to a filter to produce a 2.5 volt referencevoltage. If microcomputer 31 stops toggling the WDOG pin 69 (due tooscillator failure for example) the 2.5 volt reference voltage willdecay to become zero volts. Whether the WDOG pin ceases oscillating ineither the high or low state the capacitive coupling ensures that theoutput voltage of watchdog circuit 66 will be zero volts.

A possible external watchdog circuit is shown in FIG. 7. The output ofWDOG pin 69 is supplied via capacitor 112 and diode pump 113, 114 to thenon-inverting inputs of comparators 115 and 116. Conditioning capacitor117 and resistor 118 are also provided. Resistors 119 and 120 hold theoutputs of comparators 115, 116 in the normally high condition. Whilethe wheelchair is driving the comparator inputs ISO (121) and PB (122)will be held low by the processor (i.e. the isolation relay 21 is closedand the park brake solenoids are energized). This low state is typicallyabout 0.6 volts. Thus, when the WDOG pin is oscillating at 500 hertz theinput voltage to the non-inverting inputs of comparators 115 and 116would typically be about 2.5 volts. Thus, the outputs of bothcomparators will be high. When the input voltage to the non-invertingterminals of comparators 115, 116 goes below 0.6 volts (i.e. when theoutput of WDOG pin 69 stops oscillating) the comparator outputs go lowand pull relay drive enable line 68 and park brake enable line 67 low.This engages the park brakes and opens the isolation relay 21. Thisensures that when there is a microcomputer failure the motor drive isdisabled and park brakes enabled. Further to the external watchdogfunction described above the microcomputer includes an internal watchdogfunction which will disable outputs when an internal fault is detected.

The method of communication between modules and system operation willnow be described. The present invention aims to provide a modular systemwhich can be easily expanded or reconfigured as-required. To enablemodules to communicate information relating to state and systemvariables a system using network variables has been provided. Accordingto the system of network variables of the present invention each modulestores within its own memory the system state and variable informationit requires to operate. Each module periodically supplies over thenetwork the network variables required by other modules. In this way themodules of the system have virtual shared memory in relation to networkvariables.

Network variables may include bits, semaphores, bytes or words. Bits aresinge bit values indicating status. Semaphores consist of multiple bitswhich indicate the state of a module. Each module state has a uniquesemaphore in its "state machine register" (described in more detailhereinafter). Bytes consist of 8 bits and words consist of 16 bits.System variables are typically transmitted as bytes or words. States aretransmitted as bytes. Several status bits may be combined into a byte orword for efficiency of transmission. Such status bits may form statusflag bytes or words which may be continually transmitted. An example ofthe possible dynamic network variables for a dual motor controllermodule (as shown in FIG. 2) is given in table 1. The network variablesof type 0 are those obtained within the module which may be output toother modules requiring that network variable. The network variables oftype I are those obtained from other modules; in this case speed anddirection demands from the control module and the state of the controlmodule. The dynamic network variables may be stored in the RAM duringoperation, although default values may be stored in EEPROM and loadedinto RAM at start up.

                  TABLE 1                                                         ______________________________________                                        Dynamic Network Variables of a Motor Controller                               Module                                                                        NV      Network                                                               No.     Variation   Type     Description                                      ______________________________________                                         1      PM SM       O        Current state of PM state                                                     machine                                           2      UCM SM      I        Current state of UCM                                                          state machine                                     3      UCM SPEED   I        Speed demand from UCM                                                         demand                                            4      UCM direction                                                                             I        Direction demand                                         demand                                                                 5      PM RM demand                                                                              O        Right motor demand                                                            voltage                                           6      PM LM demand                                                                              O        Left motor demand voltage                         7      PM PWM 0    O        PPWM 0 (controlling                                                           right output) register                                                        contents                                          8      PM PWM 1    O        PPWM 1 (controlling left                                                      output) register contents                         9      PM LM +ve   O        +ve terminal voltage of                                  terminal voltage     left motor                                       10      PM LM -ve   O        -ve terminal voltage of                                  terminal voltage     left motor                                       11      PM RM +ve   O        +ve terminal voltage of                                  terminal voltage     right motor                                      12      PM RM -ve   O        -ve terminal voltage of                                  terminal             right motor                                      13      PM battery  O        Average battery voltage                                  voltage                                                               14      PM isolated O        Average battery voltage,                                 battery voltage      isolated by relay                                15      PM right    O        Right thermistor voltage                                 temperature                                                           16      PM left     O        Left thermistor voltage                                  temperature                                                           17      R Motor current                                                                           O        Right motor current                                                           output level                                     18      L motor current                                                                           O        Left motor current output                                                     level                                            19      PM temperature                                                                            O        Software current limit                                   scaler               threshold scaler                                 ______________________________________                                         Abbreviations:                                                                PM: Motor controller module                                                   UCM: Remote Control module                                                    LV: Logical variable                                                          LM: Left motor                                                                RM: Right motor                                                               SM: State machine                                                             I: Input                                                                      O: Output                                                                     B: Byte                                                                       W: Word                                                                  

Examples of programmable variables and control register values are givenin tables 2 and 3. These values will be stored in non-volatile memory(i.e. EEPROM) at the time of configuration of the system.

                  TABLE 2                                                         ______________________________________                                        Motor Controller Module Programmable Variables                                NV                 Def-                                                       No.  Variable      ault    Description                                        ______________________________________                                         1   Left motor    29      Left motor load                                         resistance            compensation setting                                2   Right motor   29      Right motor load                                        resistance            compensation setting                                3   Motor test    128     Fwd drive (+ve voltage)                                 stimulus              motor test voltage                                      level 1                                                                   4   Motor test    128     Reverse drive (-ve                                      stimulus              voltage) motor test                                     level 2               voltage                                             5   Motor test    44      Maximum acceptance                                      criterion 1           voltage on test                                     6   Motor test    6       Minimum acceptance                                      criterion 2           voltage on test                                     7   Motor test    64      Maximum acceptance                                      criterion 3           current on test                                     8   Motor test    2       Minimum acceptance                                      criterion 4           current on test                                     9   H-bridge test 128     Maximum acceptance                                      criterion 1           voltage (for test of                                                          topside MOSFET'S of H                                                         bridge)                                            10   H-bridge test 80      Minimum acceptance                                      criterion 2           voltage (for test of                                                          bottomside MOSFET's of                                                        H-bridge)                                          11   PM control 1  162     Config'n bits 0-7, refer                                                      below for bit                                                                 designations                                       12   PM control 2  109     Config'n bits 8-15, refer                                                     below for bit                                                                 designations                                       13   PM control 3  24      Config'n bits 16-23,                                                          refer below for bit                                                           designations. (Common to                                                      all DX modules)                                    14   PM status     0       Status bits, refer below                                                      for bit designations.                              15   Maximum motor 96      Motor voltage vs battery                                voltage               voltage ceiling                                                               (normally 24V)                                     16   PWM frequency 1       PWH prescaler control                                   control               register                                           17   Fault deceler-                                                                              14      Overall deceleration rate                               ation rate,           when fault detected                                     overall                                                                  18   Fault deceler-                                                                              2       Final (low demand)                                      ation rate 1          deceleration rate when                                                        fault detected                                     19   Fault deceler-                                                                              128     Initial (high demand)                                   ation rate 2          deceleration rate when                                                        fault detected                                     20   Park brake    0       Delay before park                                       delay                 brake actuated                                     21   DX bus comms  13      Time out duration                                       fault time out                                                           22   Speed and     229     Scaler to allow headroom                                direction             for steerage at maximum                                 demand scaler         speed                                              23   Veer Compen-  128     Left or right veer                                      sation scaler         compensation                                       24   Decryption key                                                                              0       Protection key                                     25   Module ID high                                                                              1       Module CAN identifier,                                                        byte (8 bits)                                      26   Module ID low 0       Module CAN identifier,                                                        low byte (3 bits)                                  27   Software current                                                                            32      Motor output current                                    limit                 limit                                              29   PWM step size 1       PWM step size when output                               (when in current      in software current limit                               limit)                and PWM reduced.                                   30   PWM step size 8       PWM step size when                                      (when in recover-     output recovering from                                  ing from current      software current limit                                  limit)                and PWM increased.                                 31   Onset of thermal                                                                            100     Thermal rollback lower                                  rollback of out-      temperature threshold                                   put current                                                              32   Thermal rollback                                                                            140     Thermal rollback upper                                  0 output limit        temperature limit                                                             (corresponding to 0                                                           output current)                                    33   RS232 comms time                                                                            5       RS232 comms time out                                    out                   duration                                           34   I.sup.2 t threshold                                                                         165     I.sup.2 t threshold as a                                                      percentage of software                                                        current limit                                      35   CAN accept code                                                                             0       Microcomputer CAN                                                             acceptance mask register                           36   Motor stall time                                                                            255     Motor stall duration                                    out                   limitation                                         37   CAN mask code 255     Microcomputer CAN mask                                                        register                                           38   CAN bus timing 0                                                                            68      Microcomputer CAN bus                                                         timing register 0                                  39   CAN bus timing 1                                                                            204     Microcomputer CAN bus                                                         timing register 1                                  40   CAN output    249     Microcomputer CAN output                                control               control register                                   ______________________________________                                         Notes to table 2:                                                             1. All logical variables are byte sized.                                      2. Default values given in decimal.                                      

                  TABLE 3                                                         ______________________________________                                        Motor Controller Module Test Registers                                        Bit                Def-                                                       No.   Register Name                                                                              ault    Description                                        ______________________________________                                        PM Control Register 1                                                         0-2   Hardware current                                                                           7       Hardware current limit                                   limit                threshold                                                                     0 = 30A, 1 = 35A, 2 = 40A,                                                    3 = 45A, 4 = 50A, 5 = 55A,                                                    6 = 60A, 7 = 65A,                                  3     Park brakes  1       Dual or single park brake                                config.              select.                                                                       0 = single, 1 = dual                               4     Motor test 1 1       Left and right motor tests                               enable               with BIR closed enable.                                                       0 = disabled, 1 = enabled                          5     Park brake test                                                                            1       Left and right park brake                                enable               test enable.                                                                  0 = disabled, 1 = enabled                          6     BIR test enable                                                                            1       BIR welded and dirty                                                          contact test enable.                                                          0 = disabled, 1 = enabled                          7     Over voltage 1       Test for battery voltage                                 test enable          too high enable.                                                              0 = disabled, 1 = enabled                          PM Control Register 2                                                         0     Serial Bus test                                                                            1       Bus test (DC voltage of                                                       CAN lines) enable.                                                            0 = disabled, 1 = enabled                          1     Motor test 2 1       Left and right motor                                     enable direction     tests                                                                         with BIR closed enable.                                                       0 = disabled, 1 = enabled                          2     Reverse motor                                                                              0       Normal or reversed motor                                 drive enable         drive direction (forward                                                      & reverse) select.                                                            0 = normal (M+ > M- for                                                       fwd), 1 = reversed.                                3     Stall time out                                                                             0       Motor stall time out.                                    enable               0 = disabled, 1 = enabled                          ______________________________________                                    

Possible Dynamic variables for a remote control module are given intable 4, possible programmable variables are given in table 5 andpossible user defined variables are listed in table 6. The user definedvariables in table 6 will be set according to the level of a usersdisability.

                  TABLE 4                                                         ______________________________________                                        Remote Control Module Dynamic Network Variables                               NV                                                                            No.     Name        Type     Description                                      ______________________________________                                        1       UCM SM      O        Current state of UCM                                                          state machine                                    2       PM SM       I        Current state of PM                                                           state machine                                    3       Proportional                                                                              O        Raw joystick forward -                                   control Y axis       reverse input value                                      input                                                                 4       Proportional                                                                              O        Raw joystick left -                                      control X axis       right input value                                        input                                                                 5       Speed magnitude                                                                           O        Processed speed demand                                                        passed to PM                                     6       Direction   O        Processed direction                                      magnitude            passed to PM                                     7       Battery voltage                                                                           I        Filtered battery input                                                        (unscaled)                                       8       PM status   I        PM and accessory fault                                                        status                                           ______________________________________                                         Abbreviations:                                                                LV: Logical Variable                                                          SH: State machine                                                             I: Input                                                                      O: Output                                                                

                  TABLE 5                                                         ______________________________________                                        Remote Control Module Programmable Variables                                  LV                 Def-                                                       No.   Name         ault    Description                                        ______________________________________                                         1    Set up session                                                                             10      Session attempt time out                                 time out             period                                              2    Park brake   254     Time allowed for PM to                                   application          complete PB application                                  delay                                                                    3    Park brake   22      Time allowed for PM to                                   release delay        complete PB release                                 4    Neutral time out                                                                           3       Time out period if                                                            joystick is in neutral                              5    UCM configuration                                                                          0       UCM config'n bits 0-7,                                   register 1           refer below for bit                                                           designations                                        6    UCM configuration                                                                          0       UCM config'n bits 0-7,                                   register 2           refer below for bit                                                           designations                                        7    Module shared                                                                              24      Shared config'n bits 0-7                                 configuration        refer below for bit                                      register             designations                                        8    Profile list 17      Profile list pointer 1                                   pointer 1            and profile pointer                                                           selector (separate                                                            nibbles)                                            9    Profile list 50                                                               pointers 2 and 3                                                        10    Profile list 4                                                                pointers 4 and 5                                                        11    Accel/decel' 64      Acceleration/                                            minimum step size    deceleration step size                                                        when approaching target                                                       size                                               12    Accel/decel upper                                                                          169     Acceleration/                                            ramp                 deceleration (slope of                                                        speed curve) when                                                             current and target                                                            speeds similar                                     13    Accel/decel lower                                                                          2       Initial acceleration/                                    ramp                 deceleration                                                                  (slope of speed curve)                                                        when current and target                                                       speeds differ greatly                              14    Accel/decel  86      Speed intercept of upper                                 intercept            and lower acceleration/                                                       deceleration slopes                                15    PJ neutral   26      Proportional joystick                                    threshold            neutral threshold                                  16    PJ neutral Y 128     Proportional joystick                                    axis offset          neutral offset for Y                                                          axis                                               17    PJ neutral X 128     Proportional joystick                                    axis offset          neutral offset for X                                                          axis                                               18    PJ forward gain                                                                            44      Proportional joystick                                                         gain calibration, for +Y                                                      axis or forward                                                               direction                                          19    PJ Reverse gain                                                                            44      Proportional joystick                                                         gain calibration, for -Y                                                      axis or forward                                                               direction                                          20    Left gain    44      Proportional joystick                                    calibration          gain calibration, for -X                                 scaler               axis or left direction                             21    Right gain   44      Proportional joystick                                    calibration          gain calibration, for +X                                 scaler               axis or right direction                            22    Decryption key                                                                             0       Protection key                                     23    Module ID high                                                                             8       Module CAN identifier,                                                        high byte (8 bits)                                 24    Module ID low                                                                              0       Module CAN identifier,                                                        low byte (3 bits)                                  25    RS232 comms time                                                                           5       Async serial interface                                   out period           (RS232) time out                                                              duration                                           26    CAN accept code                                                                            0       microcomputer CAN                                                             acceptance mask register                           27    CAN mask code                                                                              255     microcomputer CAN mask                                                        register                                           28    CAN bus timing 0                                                                           68      microcomputer CAN bus                                                         timing register 0                                  29    CAN bus timing 1                                                                           204     microcomputer CAN bus                                                         timing register 1                                  30    CAN output   249     microcomputer CAN                                                             output control                                                                control register                                   ______________________________________                                         Notes to table 5:                                                             1. All logical variables are byte sized.                                      2. Default values given in decimal.                                      

                  TABLE 6                                                         ______________________________________                                        User defined variables                                                        LV                      Def-                                                  No.      Name           ault   Description                                    ______________________________________                                        1        Forward accel' rate                                                  2        Forward decel' rate                                                  3        Reverse accel' rate                                                  4        Reverse decel' rate                                                  5        Turning accel' rate                                                  6        Turning decel' rate                                                  7        Maximum forward                                                               speed scaler                                                         8        Maximum reverse                                                               speed scaler                                                         9        Low speed scaler                                                     10       Turning speed                                                                 scaler                                                               11       Analogue speed                                                                input scaler                                                         12       Analogue tremor                                                               damping input                                                                 scaler                                                               ______________________________________                                         Notes to above table:                                                         1. All logical variables are byte sized.                                      2. Default values given in decimal.                                      

Each network variable may have the following attributes:

i) type i.e: whether an adjustable parameter or logic variable.

ii) source--whether internal or external

iii) update rate--fast--(every 20 ms) or slow (every 200 ms)

iv) size of the variable (whether a byte or a word)

v) range--the acceptable range for a parameter. Each module performsrange checking of variable parameters to ensure they are within range.The allowable range will depend upon the safety criteria for aparticular configuration.

vi) default value

Each module stores the network variables it requires in its own memory.If a module requires network variables to be updated it must transmit arequest on the serial network requesting that the network variable beupdated at a prescribed rate. The module which is the source of thatnetwork variable will then transmit the required network variable at therequested rate until a request to cease transmitting the networkvariable is sent. If two modules request the same network variable thena watchdog function monitors whether a request to stop sending thevariable is sent by one of the modules. If so, a watchdog function willre-request that the network variable be updated so that the networkvariable will still be provided to the module requiring that networkvariable.

For a system having 16 modules a 4 bit unique module identification codemay be assigned to each module.

Each module may store in a table:

i) the module identification code for the source module supplying aparticular network variable;

ii) the memory address at which the network variable is stored in thesource module, and

iii) the local address to which that network variable should be storedin the receiving module.

This is shown diagrammatically in FIG. 8. Module 6 is assigned themodule identification code 0110. Network variable 1 (NV1) is stored inthe memory location 110110 of module 6. Within module 1 is a translationtable which stores the module identification code of the module whichsupplies network variable 1 (NV1), the source memory address of thevariable and the local memory address to which network variable 1 (NV1)should be stored. From this table module 1 can write the networkvariable 1 to memory address 111110 when this network variable isreceived on the serial bus.

Each module compiles a queue of network variables which have beenrequested by other modules. These are transmitted at the specified rate.For efficiency d number of network variables are transmitted in eachpacket. Each module stores a table of the foreign network variables thatit requires. When a data packet is received the module compares themodule identification code of the source module to its table of moduleidentification codes. If the module identification code is not presentthe data packet is not scrutinised further. For example, a lightingcontrol module need not receive network variables from a motorcontroller module. Accordingly, network variables transmitted by themotor controller module can be ignored.

If however the module identification code is present in the monitoringmodule's table of module identification codes then message parsingcontinues. The receiving module then determines whether the data packetcontains information required by the module. Each network variable isread and compared with a table of required variables. If the networkvariables match then the network variable is written to the local memorylocation specified in the translation table of the module.

Each module therefore operates autonomously acting upon the networkvariables in its memory, which may be constantly updated. Semaphoresrepresentative of the states of other modules are used to determinewhether a transition to another state is permissible (described in moredetail hereinafter). Data variables are acted upon to modify the outputsof the module. For example, motor controller module, 2 may send arequest over serial bus 10 to remote control module 12 requesting thatthe network variables for speed demand, direction demand and state ofthe control module be periodically transmitted to motor controllermodule 2. At the required update rate control module 12 will forward therequested network variables on serial bus 10. Motor controller 2 willupdate the network variables held in memory in accordance with theupdates received from the control module 12 as described above. Motorcontroller 2 will thus control the outputs to the brake solenoids andmotors in accordance with the variables measured internally and thenetwork variables received from the control module 12.

Network variables may be added to a system without physically modifyingexisting modules. By reprogramming new network variables can beprogrammed into each module. This maximises the system flexibility andprovides an effective way of communicating data in a modular system.

The updating process for network variables also provides a usefulwatchdog monitor. If a module does not receive a network variable from amodule from which it has requested a network variable for apredetermined number of periods, say 5, this indicates that the sourcemodule has failed. This provides another useful check on systemoperation.

According to one embodiment of the invention each module may be assignedan 11 bit identification code. This may consist of a 4 bit group code, a4 bit type code and a 3 bit unit code. Identifying modules in this wayhas the advantage that messages can be filtered on receipt, saving theprocessor of a module from interruption by irrelevant communications.Group codes may be assigned as indicated in table 7. Type codes may beassigned as indicated in table 8 and unit codes may be assigned asindicated in tables 9 and 10.

                  TABLE 7                                                         ______________________________________                                        Group code assignments                                                        Group                                                                         codes       Classification                                                    ______________________________________                                        0           Mobility or traction control                                      1           Navigational aids                                                 2           Actuators - e.g. seat raise, recline                              3           External interfaces                                               4           Lighting controls                                                 5           Environmental controls                                            6-15        Unassigned N.B. Group code 15 cannot be                                       used with type codes 14 or 15.                                    ______________________________________                                    

                  TABLE 8                                                         ______________________________________                                        Type code assignments for group 0:                                            Type                                                                          codes       Classification                                                    ______________________________________                                        0           Single channel traction motor controller                                      module (PM)                                                       1           Dual channel traction PM                                          2           Single channel PM with servo steering                             3-7         Unassigned                                                        8           User/attendant remote control                                      9-12       Unassigned                                                        13          Programmer Configuration Diagnostic Unit                          14, 15      Unassigned                                                        ______________________________________                                    

                  TABLE 9                                                         ______________________________________                                        Unit code assignments for group 0, type 0:                                    Unit                                                                          code        Classification                                                    ______________________________________                                        0           Left channel traction PM                                          1           Right channel traction PM                                         2-3         Reserved                                                          ______________________________________                                    

                  TABLE 10                                                        ______________________________________                                        Unit code assignments for group 0, type 8:                                    Unit        Classification                                                    ______________________________________                                        0           User control (Proportional or switched                                        joystick)                                                         1           Attendant control                                                 2-3         Reserved                                                          ______________________________________                                    

The control module will be included in every group to ensure that it cancommunicate with all modules, regardless of the filtering operation.This filtering can be implemented using the filtering provided in themicrocomputer using acceptance filtering through use of the acceptancecode register (ACR) and acceptance mask register (AMR), acting on themost significant 8 bits of the identification code (i.e. the group codeand type code).

To facilitate communications between a given group of modules a sessionlayer may be created in the network software. This enables a number ofmodules to dynamically form groups of modules which will communicate tothe exclusion of other modules. The "insession" modules will acceptexternal communications only to read their status (variables and statustype). One or more master/slave relationships may be establisheddepending upon the privilege levels assigned to each module. Forexample, a control module may be assigned master status when insessionwith a motor controller module. However, if a navigation module isincluded in the group it may be assigned mastership. Sessions may onlybe created and mastership allocated when a module is in a safe state.The forming of sessions enables the modules involved in a particularprocess to complete that process without interruption from externalmodules. Such sessions may be dynamically established and dissolved.

According to a preferred embodiment of the invention each module acts asa finite state machine. That is to say, each module has a given numberof possible states and transition from one state to another is onlypossible if the module is in a given state and certain conditions aresatisfied. In a complex modular system it is desirable for theoperations of modules to be synchronised. To achieve synchronisationeach module operates as a finite state machine. That is, the module hasa number of unique states represented by a unique semaphore. Transitionsare only possible between certain states upon certain prerequisiteconditions being satisfied.

Each module stores in its memory the network variables representative ofthe state of other modules which affect the transitions of that modulefrom one state to another. The condition(s) that must be satisfied for amodule to move from one state to the next may be the state of anothermodule or the state of an internally measured parameter or a combinationof both. Referring to FIG. 9 a state diagram for a motor controllermodule is shown. FIGS. 10 and 11 show the left hand side and right handside respectively of the diagram shown in FIG. 9 in more detail. Theword following the letter "C" next to each arrow indicates the conditionthat must be satisfied for the module to transfer to the next state. Theword adjacent the letter "A" indicates the action of the module whentransferring to the next state. The word within each circle describesthe state and the word below, adjacent the letter "A", indicates theaction performed in that state. Upon the microprocessor being reset(200) the motor control module goes into the initialise state 201. Inthis state the module performs the required initialisation routines. Ifa fault condition is discovered during initialisation the faultcondition of path 202 is satisfied and the module passes from the"initialised" state 201 via path 202 to the "fault" state 203. If themodule receives a "power down" command from the command module the"powerdown" condition is met and the module passes to "powerdown" state204. In this state the motor controller module performs the requiredpower down sequences.

In normal operation initialisation will be completed in state 201 andthe wait timer will elapse. In these circumstances the condition to passto state 205 is satisfied. The motor controller module waits in"safewait" state 205 until a further condition is satisfied. If theJoystick of the control module is moved the control module will go into"insession" state. The semaphore for this state will be passed over theserial network and stored in the memory of the motor controller moduleas a network variable. When the motor controller module detects that thenetwork variable for the controller module state has changed to the"insession" state the condition fox transition to state 208 will besatisfied. The motor controller module will thus pass to state 208 andthe motor controller module state "insession" will be stored as anetwork variable in memory, passed to the control module and stored as anetwork variable in its memory. In response to the new motor controllermodules state and the joystick command the control module will pass to a"release brake" state. Again, the network variable for the state of thecontrol module will pass over the serial network to be stored in themotor controller module. Upon detection that the control module statehas changed to the "release brake" state the condition for transition tostate 209 is satisfied. Transition to the "release brake" state 209 bythe motor controller module results in the action that the brake isreleased. The control module then detects the motor controller modulehas passed to the "release brake" state and passes to the "drive" state.Again, when the motor control module detects that the control module haschanged state to the "drive" state it may pass to drive state 210. Onlywhen in drive state 210 can the motors be driven in response to thespeed and direction demands from the control module. Accordingly, forthe motors to be driven the motor control unit must be in the "drive"state and receive speed and direction demands from the control module.

When the control module changes to its "stop" state the motor controlmodule passes to a "pendstop" state 211. Before a brake can be appliedthe module must pass to the "apply brake" state 212. The condition to besatisfied for transition to the "apply brake" state 212 is that themotor speed must be zero. This is an internal variable measured by themotor control module. When the zero motor speed condition is satisfied,brakes may be applied. A predetermined time after the brakes are applieda park brake timer elapses. When the park brake timer elapses and thebrakes are being applied the resulting action is that the park brakesare applied and the state of the motor controller module passes to the"insession" state 208.

State transitions of the modules are arranged so that the passing ofmodules between states is synchronised, and modules can only passbetween certain states if the state of another module has changed tosatisfy a required condition. An example of state changes between acontrol module (UCM) and dual motor control module (PM) in use is givenin table 11.

                  TABLE 11                                                        ______________________________________                                        Seq     User action  UCM state    PM state                                    ______________________________________                                        1a      Switch on    INITIALISE   INITIALISE                                  1b                   SAFEWAIT     SAFEWAIT                                    2A      JS forward (or                                                                             SAFEWAIT     SAFEWAIT                                            rev, left, right)                                                     2b      INSESSION    INSESSION                                                2c      RELBRAKE     RELBRAKE                                                 2d      NEUTRAL                                                               2e      DRIVE        DRIVE                                                    3a      JS returned to                                                                             DRIVE        DRIVE                                               neutral for 2                                                                 seconds or more                                                       3b      NEUTRAL      PENDSTOP                                                 3c      APPLYBRAKE   APPLYBRAKE                                               3d      INSESSION    INSESSION                                                3e      SAFEWAIT     SAFEWAIT                                                 4a      Fault while  DRIVE        DRIVE                                               driving                                                               4b      NEUTRAL      PENDSTOP                                                 4c      APPLYBRAKE   APPLYBRAKE                                               4d      INSESSION    INSESSION                                                4e      SAFEWAIT     SAFEWAIT                                                 4f      FAULT        FAULT                                                    ______________________________________                                    

Both modules pass from the "initialise" to the "safewait" state onceinternal checks have been satisfied. Upon movement of the joystick thecontrol module passes to the "insession" state. The network variablesemaphore for the state of the control module is updated in the motorcontroller module. The new control module state satisfies the conditionfor the motor control module to pass to the "insession" state also. Thecontrol module detects that the motor control module has passed to the"insession" state, which allows it to pass to the "release brake" state.This change of state satisfies the condition for the motor controlmodule to pass to the "release brake" state. The transition of the motorcontrol module to the "release brake" state enables the control moduleto pass to the "neutral" state. This does not result in the change ofstate of the motor control module. The control module then passes to the"drive" state which satisfies the condition allowing the motor controlmodule to pass to the "drive" state. It can be seen that the statetransitions of the control module and motor control module areinterdependent. Should either module fail to make a state transitionthis will prevent the other module from passing to a further state. Thisprovides a further check between devices to ensure correct. Operationand synchronise operation. Furthermore it provides a further safeguardas the outputs of safety related modules are only enabled in a limitednumber of states.

Another important feature of the motor controller is a technique used toenhance the resolution of an eight bit pulse width modulator. Lessexpensive microcomputers usually only include eight bit pulse widthmodulators. The resolution of eight bit pulse width modulators isnoticeably coarser than analogue control.

According to the method of the present invention the output of the pulsewidth modulator is smoothed by modulating the value applied to the pulsewidth modulator over a number of cycles.

Upon comparing the back EMF feedback signal with a desired motorvelocity value the micro computer may generate an internal ten bitdriving signal (8+2 bits (N+M)). The two least significant bitsdetermine whether one bit is added to the 8 most significant bits foreach pulse width modulator cycle. Table 1 shows for a ten bit inputvalue whether or not 1 bit is added for each cycle. A "1" indicates oneis added for a cycle and a "0" indicates nothing is added to the 8 bitvalue.

Each sampling period for a ten bit input value preferably consists of 4(2^(M)) pulse width modulator cycles. At the end of each sampling perioda new ten bit motor control value is inputted.

                  TABLE 1                                                         ______________________________________                                        M bit values                                                                              Cycle 1 Cycle 2   Cycle 3                                                                             Cycle 4                                   ______________________________________                                        00          0       0         0     0                                         01          0       0         0     1                                         10          0       1         0     1                                         11          1       1         0     1                                         ______________________________________                                    

It will be appreciated that the method may be used for any number ofbits desired. The method effectively gives 1024 output values (for 10input bits) instead of 256 (for 8 input bits) for the same samplingperiod.

Where in the aforegoing reference has been made to integers orcomponents having known equivalents then such equivalents are hereinincorporated as if individually set forth.

Although this invention has been described by way of example and withreference to possible embodiments is to be understood that improvementsor modifications may be made thereto without departing from the scope ofthe invention as defined in the appended claims.

INDUSTRIAL APPLICABILITY

The control means of the present invention may find application in thecontrol of motors for wheelchairs, scooters and the like. The inventionis particularly suitable for applications where an expandible modularcontrol system is required.

We claim:
 1. A control means for an electrically driven vehiclecomprising:two or more modules interconnected by a serial bus, saidserial bus including one or more data lines, wherein one or more modulesof said two or more modules includes means to shift a DC bias voltage ona data line of said serial bus, and one or more of said two or moremodules includes means to alter the operating state of said two or moremodules between an enabled and disabled condition while maintaining datacommunication between the two or more modules, wherein the means foraltering the operational state of said modules corresponds to a killmeans which monitors the DC bias voltage on said data line of saidserial bus and disables functions of that module when the detected DCbias voltage is outside a set voltage range and wherein a user controlswitch is provided on a remote control module which can clamp the biasvoltage on the serial bus below the lowest value of the set voltagerange.
 2. A control means as claimed claim 1 wherein the kill means of amotor controller module disables driving circuitry which drives one ormore electrical motors by opening the contacts of an isolation relaywhich connects a battery supply to the driving circuitry.
 3. A controlmeans as claimed in claim 2 wherein the kill means of a motor controllermodule causes a park brakes of the vehicle to be applied.
 4. A controlmeans as claimed in claim 1 wherein the kill means of a motor controllermodule causes at least one park brake of the vehicle to be applied.
 5. Acontrol means as claimed in claim 1 wherein the kill means of a motorcontroller module disables driving circuitry which drives one or moreelectrical motor by disabling logic circuitry which supplies drivingsignals to the driving circuitry.
 6. A control means as claimed in claim1 wherein the serial bus has two data lines and the DC bias voltage isonly applied to one of the data lines.
 7. A control means as claimed inclaim 1 wherein all modules include kill means which monitor the DC biasvoltage and disable safety related functions of each applicable modulewhen the DC bias voltage is outside the set voltage range.
 8. A controlmeans as claimed in claim 1 wherein all modules include means to shiftthe DC bias voltage on the serial bus outside the set voltage range upondetection of a fault.
 9. A control means as claimed in claim 1 whereinthe kill means comprises a window detector which disables functions ofthe module when the detected DC bias voltage is above or below a setrange of allowed bias voltages.
 10. A control means as claimed in claim1 wherein functions of the one or more module are disabled apredetermined period after a shift in DC bias voltage is detected toenable the one or more module to assume a safe state before functions ofthe module are disabled.
 11. A control means as claimed in claim 1wherein at least one module includes wake-up means which monitors thebias level of said data line of the serial data bus when the module isdeactivated and supplies power to the module upon detecting that the DCbias level is outside a set range.
 12. A module for use in a modularcontrol means for an electrically driven vehicle, the modules of saidmodular control means being interconnected by a serial bus, wherein themodule includes kill means to disable functions of the module upondetecting that a DC bias level on a data line of the serial bus isoutside a set range, wherein the module includes means to bias the dataline of the serial bus outside the set range upon detection of a fault.13. A module as claimed in claim 12 wherein the kill means includes awindow detector which disables functions of the module when the DC biasvoltage level is above or below a set range of DC bias voltages.
 14. Amodule as claimed in claim 12 wherein the serial data bus has two datalines and the DC bias voltage is only applied to one of them.
 15. Amodule as claimed in claim 12 wherein the module is a motor controllermodule and the kill means disables driving circuitry driving one or moreelectrical motor by opening the contacts of an isolation relay whichconnects a battery supply to the driving circuitry.
 16. A module asclaimed in claim 12 wherein the module is a motor controller module andthe kill means, when invoked, causes at least one park brake of thevehicle to be applied.
 17. A module as claimed in claim 12 wherein themodule is a motor controller module and the kill means, when invoked,disables driving circuitry driving one or more electrical motor bydisabling logic circuitry which supplies driving signals to the drivingcircuitry.
 18. A module as claimed in claim 12 wherein functions of themodule are disabled a predetermined period after a shift in DC biasvoltage is detected to enable the module to assume a safe state beforefunctions of the module are disabled.
 19. A module for use in a modularcontrol means for an electrically driven vehicle, the modules of saidmodular control means being interconnected by a serial bus, wherein themodule includes kill means to disable functions of the module upondetecting that a DC bias level on a data line of the serial bus isoutside a set range wherein the module is remote control module which isprovided with a user controlled switch which can clamp the bias voltageon the data line of the serial bus below the lowest value of the setvoltage range.
 20. A module as claimed in claim 12 including wake-upmeans which monitors the bias level of said data line of the serial databus when the module is deactivated and supplies power to the module upondetecting that the DC bias level is outside a set range.